Agent skill · Audited from source
Ui Craft
skill · pedronauck/skillsLicence not declaredAudited 16 Oct 2026 · source 118e61cf1c61
Is it safe? With care — CAUTION, grade B (89/100). We read this skill's source at commit 118e61cf1c61 and found no filesystem, network or shell access and no hard-coded secrets. The audit raised 2 findings, 0 critical or high. What it does: Design, build, review, or refactor visible UI, including pages, components, forms, loading/error states, and AI chat/streaming interfaces. Excludes backend, infrastructure, CLI/TUI, and docs-only work.
Cite
Cite this page
ModelsAtlas. “Ui Craft (pedronauck/skills)”. Retrieved 16 Oct 2026. https://modelsatlas.com/skills/pedronauck/ui-craft
Trust audit
Audit 0.4.1 · source read 16 Oct 2026
CAUTION means the audit found things worth knowing before you trust this skill. Grade B is shared by 16,667 of 17,602 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 0 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | WARN | 2 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 0 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (2)
MEDIUMInformation disclosuredisclose.log_secret · scripts/detect-token-drift.mjs:69
console.log(`detect-token-drift.mjs — find raw color values bypassing tokens.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMInformation disclosuredisclose.log_secret · scripts/detect-token-drift.mjs:181
console.log(`Token drift detected — ${allFindings.length} raw color value(s) outside token paths:\n`);- Why
- No further detail recorded for this rule.
- Fix
- —
Audit 0.4.1 · source sha 118e61cf1c61 · 16 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherpedronauck GitHub userOwner of the repository this skill is read from
- Source folderpedronauck/skills/skills/mine/ui-craftThe exact folder we audited
- LicenceNot declaredAs the repository states it
- Commit pinned for this verdict118e61cf1c61A new audit runs when the source changes
- Repository statusNot archivedLast push 31 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Design, build, review, or refactor visible UI, including pages, components, forms, loading/error states, and AI chat/streaming interfaces. Excludes backend, infrastructure, CLI/TUI, and docs-only work.
--- name: ui-craft description: "Design, build, review, or refactor visible UI, including pages, components, forms, loading/error states, and AI chat/streaming interfaces. Excludes backend, infrastructure, CLI/TUI, and docs-only work." metadata: author: Pedro Nauck github: https://github.com/pedronauck repository: https://github.com/pedronauck/skills --- # UI Craft Use the project's visual and copy authorities, shipped primitive inventory, and real runtime behavior. Preserve keyboard/focus operation, supported states, meaningful labels, contrast, reduced motion, and token ownership. For a small edit, inspect the affected component/state and reuse existing decisions. A new surface or substantial redesign may need a short user job, scene, register, or visual dials when those resolve an actual design choice; they are not required artifacts for every tweak. - Read the relevant design/token/copy contract. When generated documentation and runtime tokens disagree, follow the project's canonical-source rule and regenerate through its owning tool. - Reuse existing primitives and supported states. Do not invent controls, metrics, helper copy, brand variants, or host chrome to satisfy a prototype. - Match verification to changed interaction/visual behavior: render the affected states, check keyboard/focus where interaction changes, and compare a named reference when required. Reuse current evidence; whole-surface matrices and all-breakpoint sweeps need corresponding scope. - Review actual hierarchy, overflow, token drift, misleading interaction, and accessibility defects. Avoid a fixed scorecard that turns subjective preferences into universal merge blockers. - Update design authorities only for an actual token/pattern change, through their generator when owned by codegen. A missing optional reference does not justify scaffolding a new design system. ## References by Need Use the matching section and its necessary dependencies. The table is a lookup, not a list to load in full. `assets/state-matrix.md`, `assets/pre-ship-checklist.md`, and `assets/ui-audit-template.md` are optional working formats for substantial design/audit tasks; ordinary changes can use concise evidence. | When | File | Covers | | --------------------------------------------------------------- | --------------------------------------- | ------------------------------------------------------------------ | | Designing a novel surface / auditing usability | `references/usability-foundations.md` | Nielsen 10, Laws of UX, progressive disclosure, mental models | | Any interactive widget (dialog, menu, combobox, tabs, slider) | `references/accessibility-floor.md` | WCAG 2.2 AA non-negotiables, ARIA patterns, verification recipes | | Buttons/inputs/dialogs/nav/tables/cards/dropdowns/tabs/toasts | `references/component-patterns.md` | States, keyboard contract, a11y, and slop per component | | Writing or reviewing user-visible text | `references/microcopy-quality.md` | Banned vocabulary, per-surface tone, error/empty/CTA templates | | Auditing AI-generated UI | `references/ai-slop-patterns.md` | Before/after + remediation for the 14 patterns, detection prompts | | A design choice needs reconsideration | `references/anti-defaults.md` | Contextual alternatives for hierarchy, legibility, and interaction | | Building an AI/agent surface | `references/human-ai-ux.md` | Microsoft 18 + IBM 4 pillars, streaming/citation/confidence UI | | Reading/extending DESIGN.md, tokens, shadcn/Radix, codegen rules| `references/design-system-integration.md`| DESIGN.md sections, token discipline, Figma/Code Connect | | No token system, or extending a scale | `references/visual-craft.md` | Type/color/spacing/radius/elevation/motion defaults | | Adding or reviewing animation | `references/motion-patterns.md` | Duration bands, easing, CSS/Framer/`@starting-style`, reduced-motion| | Implementing or reviewing dark mode | `references/dark-mode.md` | Surface-lightness elevation, accent desaturation, dangerous pairs | | Observed slowdown, performance-sensitive change, or requested audit | `references/performance.md` | Measurement, loading feedback, relevant optimizations, project budgets | | "We need a [Linear/Notion]-like X" | `references/archetypes.md` | 7 archetypes, each a six-slot signature contract | ## Helpers Resolve these from the actual skill directory (`<ui-craft-dir>`); run only for the question in scope: - `node <ui-craft-dir>/scripts/check-contrast.mjs` — read-only contrast calculation for changed rendered colors. - `node <ui-craft-dir>/scripts/detect-token-drift.mjs` — read-only drift scan; use project lint/codegen evidence when it already owns the invariant. - `python3 <ui-craft-dir>/scripts/validate-metadata.py` — authoring metadata validation. Follow explicit user decisions and project authorities for trade-offs. Record material limitations honestly; do not force a scene interview, design audit, or another approval solely because this skill was used.
Excerpt, first 5,584 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 118e61c
git clone https://github.com/pedronauck/skills git -C skills checkout 118e61cf1c61
The author documents no install command, so this uses the repository directly. Our verdict covers commit 118e61cf1c61 only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Claude Code | Mentioned in its text, not tested | Skills for Claude Code · About Claude Code |
| GitHub Copilot | Mentioned in its text, not tested | Skills for GitHub Copilot · About GitHub Copilot |
| Cursor | Mentioned in its text, not tested | Skills for Cursor · About Cursor |
Audit history
Every audit, every source change
- !CAUTION B 89 / 100
first audit · source
118e61cf1c61
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/pedronauck/ui-craft/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
All design & front-end skills →obra/superpowers
Use when creating new skills, editing existing skills, or verifying skills work before deployment
mattpocock/skills
A relentless interview to sharpen a plan or design, which also creates docs (ADR's and glossary) as we go.
mattpocock/skills
Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.
Add this badge to your README
[](https://modelsatlas.com/skills/pedronauck/ui-craft/)
<a href="https://modelsatlas.com/skills/pedronauck/ui-craft/"><img src="https://modelsatlas.com/skills/pedronauck/ui-craft/badge.svg" alt="ModelsAtlas: CAUTION B"></a>
Questions about Ui Craft
What does the Ui Craft skill do?
Is Ui Craft safe to install?
What can Ui Craft access on my machine?
Which assistants does Ui Craft work with?
How current is this page?
Sources
- github.com/pedronauck/skills/tree/main/skills/mine/ui-craft — the audited source at commit 118e61cf1c61 and every finding aboveObserved · 16 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the Ui Craft skill do?
- Is Ui Craft safe to install?
- What can Ui Craft access on my machine?